#!/bin/bash

# Function to check the status of the last command
check_status() {
  if [ $? -ne 0 ]; then
    echo "执行上一个命令时出错。退出。"
    exit 1
  fi
}

# 关闭防火墙
echo "1. 检查 firewalld 状态..."
if systemctl is-active --quiet firewalld; then
  echo "正在停止 firewalld..."
  systemctl stop firewalld
  check_status
else
  echo "firewalld 已经停止。"
fi

echo "2. 检查 firewalld 是否已禁用..."
if systemctl is-enabled --quiet firewalld; then
  echo "正在禁用 firewalld..."
  systemctl disable firewalld
  check_status
else
  echo "firewalld 已禁用。"
fi

# 关闭 SELinux
echo "3. 检查 SELinux 状态..."
if grep -q 'SELINUX=enforcing' /etc/selinux/config; then
  echo "正在禁用 SELinux..."
  sed -i 's/enforcing/disabled/' /etc/selinux/config
  check_status
fi

if [ "$(getenforce)" != "Disabled" ]; then
  echo "将 SELinux 设置为宽容模式..."
  setenforce 0
  check_status
else
  echo "SELinux 已禁用。"
fi

# 关闭 swap
echo "4. 检查 swap 状态..."
if swapon --show | grep -q 'partition'; then
  echo "正在关闭 swap..."
  swapoff -a
  check_status
else
  echo "swap 已经关闭。"
fi

if grep -q 'swap' /etc/fstab; then
  echo "正在禁用 /etc/fstab 中的 swap..."
  sed -ri 's/.*swap.*/#&/' /etc/fstab
  check_status
else
  echo "/etc/fstab 中的 swap 已禁用。"
fi

# 配置 sysctl
echo "5. 正在检查和配置 sysctl 参数..."
sysctl_config="/etc/sysctl.d/k8s.conf"
if [ ! -f "$sysctl_config" ]; then
  cat > $sysctl_config <<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward=1
net.ipv4.tcp_tw_recycle=0
vm.swappiness=0
vm.overcommit_memory=1
vm.panic_on_oom=0
fs.inotify.max_user_instances=8192
fs.inotify.max_user_watches=1048576
fs.file-max=52706963
fs.nr_open=52706963
net.ipv6.conf.all.disable_ipv6=1
net.netfilter.nf_conntrack_max=2310720
EOF
  check_status

  echo "正在应用 sysctl 参数..."
  sysctl --system
  check_status
else
  echo "sysctl 参数已配置。"
fi

# 时间同步
echo "6. 检查 ntpdate 是否安装..."
if ! rpm -q ntpdate > /dev/null; then
  echo "正在安装 ntpdate..."
  yum install -y ntpdate
  check_status
else
  echo "ntpdate 已安装。"
fi

echo "正在与 cn.pool.ntp.org 同步时间..."
ntpdate cn.pool.ntp.org
check_status

# 关闭不需要的服务
echo "7. 关闭不需要的服务"
echo "检查 postfix 状态..."
if systemctl is-active --quiet postfix; then
  echo "正在停止 postfix..."
  systemctl stop postfix
  check_status
else
  echo "postfix 已经停止。"
fi

if systemctl is-enabled --quiet postfix; then
  echo "正在禁用 postfix..."
  systemctl disable postfix
  check_status
else
  echo "postfix 已禁用。"
fi

# 设置 rsyslogd 和 systemd journald
echo "8. 持久化 journald 日志"
echo "正在检查和创建 journald 目录..."
if [ ! -d /var/log/journal ]; then
  mkdir -p /var/log/journal
  check_status
fi

if [ ! -d /etc/systemd/journald.conf.d ]; then
  mkdir -p /etc/systemd/journald.conf.d
  check_status
fi

echo "正在检查和配置 journald..."
journald_config="/etc/systemd/journald.conf.d/99-prophet.conf"
if [ ! -f "$journald_config" ]; then
  cat > $journald_config <<EOF
[Journal]
# 持久化保存到磁盘
Storage=persistent

# 压缩历史日志
Compress=yes

SyncIntervalSec=5m
RateLimitInterval=30s
RateLimitBurst=1000

# 最大占用空间 10G
SystemMaxUse=10G

# 单日志文件最大 200M
SystemMaxFileSize=200M

# 日志保存时间 2 周
MaxRetentionSec=2week

# 不将日志转发到 syslog
ForwardToSyslog=no
EOF
  check_status

  echo "正在重启 systemd-journald..."
  systemctl restart systemd-journald
  check_status
else
  echo "journald 已配置。"
fi

# 安装 ipvsadm
echo "9. 检查 ipvsadm 是否安装..."
if ! rpm -q ipvsadm > /dev/null; then
  echo "正在安装 ipvsadm..."
  yum -y install ipvsadm
  check_status
else
  echo "ipvsadm 已安装。"
fi

echo "正在加载 br_netfilter 模块..."
if ! lsmod | grep -q br_netfilter; then
  modprobe br_netfilter
  check_status
else
  echo "br_netfilter 模块已加载。"
fi

# 加载 IPVS 模块
echo "10. 正在检查和创建 IPVS 模块脚本..."
ipvs_modules="/etc/sysconfig/modules/ipvs.modules"
if [ ! -f "$ipvs_modules" ]; then
  cat > $ipvs_modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
# modprobe -- nf_conntrack_ipv4  # 内核5.0以上配置为 nf_conntrack
modprobe -- nf_conntrack
EOF
  check_status

  echo "正在使 IPVS 模块脚本可执行..."
  chmod 755 /etc/sysconfig/modules/ipvs.modules
  check_status
else
  echo "IPVS 模块脚本已存在。"
fi

echo "正在执行 IPVS 模块脚本..."
bash /etc/sysconfig/modules/ipvs.modules
check_status

echo "正在检查加载的模块..."
lsmod | grep -e ip_vs -e nf_conntrack_ipv4
check_status

echo "所有步骤执行成功。"
